Research Paper Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:07 AM UTC
• Version: 1.0.2

Overview

This literature-monitoring skill is mostly purpose-related, but it overstates its capabilities and handles webhooks, research interests, local archives, scheduling, and outbound integrations with insufficient security disclosure.

Review before installing. Replace and rotate the documented Feishu webhook if it was real, change arXiv access to HTTPS, protect ~/.openclaw/research-monitor/config.json with owner-only permissions, and enable cron, webhooks, email, Zotero, or cloud backup only if you are comfortable sending research interests and paper metadata to those services.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: references/configuration.md:91

Finding

Concrete Feishu Webhook Token Embedded in Documentation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor.py:68

Finding

Research Keywords Transmitted Through Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.py:153

Finding

Webhook Secret Stored Without Explicit Owner-Only File Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/advanced-usage.md:92

Finding

Documented SMTP Authentication Does Not Enable TLS

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

该代码的总体方向与声明相近，都是科研文献监测、筛选、摘要和报告归档，因此不是完全无关的技能。但描述明显高估了实现能力。最关键的差异在于：多信源监测并未真正实现，实际可用采集仅有 arXiv；中文摘要是静态模板而非真正摘要；飞书通知未实际发送；也未见每周推送逻辑。因此，声明与实际行为存在实质性不一致，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个较完整的文献监测、摘要生成和推送系统，而代码实际只是一段用于搜索论文的CLI脚本骨架。它没有定时监测、没有推送、没有摘要生成，也没有真实调用 arXiv、PubMed、CNKI 等外部信源接口；所谓搜索结果是硬编码的示例数据。虽然“按信源、关键词、时间范围搜索论文”与声明中的一部分场景相关，但整体主功能与宣称能力存在明显落差，因此应判定为描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/configuration.md (reported line 195)May include surrounding context.

删除配置文件后重新运行 config.py：

bash

rm ~/.openclaw/research-monitor/config.json
python3 config.py

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents capabilities that involve local file access, file writes, and network access, but it does not declare any explicit tool scope or permissions boundary. In agent ecosystems, missing scope declarations can cause overbroad execution privileges or make risky behavior less visible to reviewers and users, increasing the chance of unintended data access or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description states that the system will '生成中文摘要并推送', which imposes a specific output language as a default behavior. Under the policy, forcing a language or locale without user choice is a natural-language policy violation unless the locale constraint is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The overview and core features describe the skill as generating Chinese summaries, but do not indicate that users may select another language. This is a natural-language policy concern because the skill appears to enforce a specific language across normal operation without opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/advanced-usage.md (reported line 25)May include surrounding context.

bash

# 编辑 crontab
crontab -e

# 添加每日8点执行任务
0 8 * * * /usr/bin/python3 ~/.openclaw/workspace/skills/research-paper-monitor/scripts/monitor.py >> ~/.openclaw/research-monitor/cron.log 2>&1

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest says delivery requires configuring a Feishu channel and frames the skill as a literature monitor with summary push notifications. This advanced-usage section instructs users to modify the skill to send email via SMTP, introducing a new outbound messaging and credential-handling capability not justified by the stated scope of the skill file being audited.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The email notification example automates sending paper content/summary data through SMTP without warning users that information leaves the local environment and may be stored by email providers. Because this skill handles research-monitoring outputs, users may inadvertently disclose sensitive topics, notes, or institution-specific monitoring interests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest only mentions push delivery through Feishu configuration, but this section documents adding Enterprise WeChat webhook delivery. That is a separate external integration and outbound network capability not described in the skill’s stated purpose and channel scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The WeCom webhook example posts monitored content to an external service but does not warn users that paper metadata or summaries are being transmitted outside the local system. Webhook endpoints are easy to misconfigure or share, which increases the chance of unintended disclosure of monitored research interests or generated summaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/advanced-usage.md (reported line 119)May include surrounding context.

"content": format_papers_for_wechat(papers) } } requests.post(url, json=data)

text

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation recommends automatic cloud backup with rclone but provides no warning that locally stored research data and derived summaries may be transmitted off-device to a third-party service. In a research-monitoring context, exported paper lists, notes, and summaries can contain sensitive or proprietary information, so silent backup guidance can lead to unintentional disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes monitoring academic sources, filtering papers, generating Chinese summaries, and pushing updates. This section goes further by creating records in a third-party bibliography service through its API, which is a separate data-export/write capability not necessary for the described purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Zotero API upload example automatically sends bibliographic data to a third-party service without any disclosure. Even if the uploaded fields are limited, users may not expect outbound transmission of collected research records, and API-key-based integrations can expose or persist data outside the skill’s local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/advanced-usage.md (reported line 237)May include surrounding context.

md

def add_to_zotero(paper, zotero_api_key, user_id):
    """添加论文到 Zotero"""
    url = f"https://api.zotero.org/users/{user_id}/items"
    headers = {
        "Zotero-API-Key": zotero_api_key,
        "Content-Type": "application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/advanced-usage.md (reported line 250)May include surrounding context.

"date": paper['published_date'] }

text

response = requests.post(url, headers=headers, json=data)
return response.status_code == 200

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation includes a realistic-looking Feishu webhook URL without clearly warning that webhook endpoints are secrets that should not be shared, logged, or committed. Users may copy real webhooks into config files or repositories, enabling unauthorized parties to send messages to their Feishu groups or abuse the integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is written entirely in Chinese, beginning with a Chinese-only title, and does not indicate that the skill is region-specific or that users may opt into another language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-sources.md (reported line 119)May include surrounding context.

md

**API/搜索方式**:
- 网站: https://www.semanticscholar.org/
- API: https://api.semanticscholar.org/
- 无需API Key即可使用

**注意事项**:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains user-facing natural-language prompts and descriptions exclusively in Chinese, starting with the module docstring and continuing throughout the interactive setup flow. Because the skill does not offer the user a language/locale choice or explain that it is intentionally limited to a Chinese-speaking context, it creates a language policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language descriptions in Chinese, including the module docstring and CLI help/output text, but provides no opt-in or alternative language support. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The index file records titles, URLs, scores, matched keywords, and local file paths, creating a durable history of the user's research monitoring activity. The write is silent from a user perspective beyond internal docstrings/comments, so users are not explicitly informed that this tracking data is retained.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description claims automatic monitoring of multiple sources such as arXiv, PubMed, and CNKI. In code, search_pubmed, search_google_scholar, and the CNKI/IEEE/Semantic Scholar handlers are placeholder implementations that return empty lists, so the actual behavior is much narrower than advertised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function name, docstring, and returned summary structure enforce Chinese output regardless of user preference. This is a natural-language locale constraint embedded in the skill with no opt-in, fallback, or explanation that the tool is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.